Loading story…
CISA said ransomware gangs are actively exploiting CVE-2025-60710, a high-severity Windows Task Host privilege escalation vulnerability affecting Windows 11 and Windows Server 2025. The bug stems from CWE-59 improper link resolution, or "link following," and allows a local attacker with basic user privileges to gain SYSTEM access on unpatched devices. Microsoft released a fix for the flaw in November 2025, while CISA previously added it to the Known Exploited Vulnerabilities catalog before updating the entry to note ransomware abuse.
CISA has not disclosed technical details about the attacks, and Microsoft had not updated its advisory at the time of reporting to confirm observed exploitation in the wild. Federal Civilian Executive Branch agencies were ordered to remediate the issue within two weeks, underscoring the urgency of patching systems exposed to the vulnerability. The disclosure also fits a broader pattern of ransomware operators targeting Microsoft product flaws, including the recently exploited SharePoint vulnerability CVE-2026-45659.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
CISA later updated the KEV entry for CVE-2025-60710 to state that ransomware gangs are abusing the vulnerability. The agency also directed Federal Civilian Executive Branch agencies to remediate the issue within two weeks.
Microsoft released a patch for CVE-2025-60710, a high-severity Windows Task Host privilege escalation vulnerability affecting Windows 11 and Windows Server 2025. The flaw is caused by a link-following weakness that can let a local attacker with basic user permissions gain SYSTEM privileges.
CISA added CVE-2025-60710 to its Known Exploited Vulnerabilities catalog and initially flagged it as actively exploited. The agency identified the Windows Task Host flaw as posing significant risk to federal systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcecisa.gov
Open sourcecwe.mitre.org
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in the Windows SMB client, tracked as CVE-2025-33073, is being actively exploited by threat actors months after Microsoft released a patch. The flaw, which affects Windows 10, Windows 11 (up to version 24H2), and all supported versions of Windows Server, was initially addressed in Microsoft's June 2025 Patch Tuesday update. The vulnerability allows attackers to escalate privileges to SYSTEM level by coercing a victim machine to connect to a malicious SMB server, where the protocol can be compromised. Attackers can exploit this by executing a specially crafted script or convincing users to run such a script, leading to authentication with the attacker's server and subsequent compromise. Security researchers from organizations including CrowdStrike, Synacktiv, GuidePoint Security, BNP Paribas, SySS GmbH, RedTeam Pentesting GmbH, and Google Project Zero contributed to the discovery and public disclosure of the flaw. Some researchers have highlighted that the vulnerability bypasses NTLM reflection mitigations and can be used for authenticated remote command execution, not just privilege escalation as initially described by Microsoft. Technical details and proof-of-concept exploits have been published, increasing the risk of widespread exploitation. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-33073 to its Known Exploited Vulnerabilities (KEV) catalog on October 20, 2025, confirming active exploitation in the wild. CISA has mandated that all US federal civilian agencies apply the patch or remove vulnerable systems from operation by November 10, 2025, under Binding Operational Directive 22-01. While this directive is specific to federal agencies, CISA has strongly urged all organizations to remediate the vulnerability immediately due to the ongoing attacks. The vulnerability was publicly disclosed at the time of patch release, but exploitation was not observed until months later, underscoring the importance of timely patch management. Microsoft has not yet issued a public statement regarding the active exploitation. The flaw's ability to bypass existing mitigations and enable remote command execution makes it particularly dangerous for enterprise environments. Organizations that have not yet applied the June 2025 patch remain at significant risk of compromise. The ongoing exploitation highlights the persistent threat posed by delayed patching and the rapid weaponization of disclosed vulnerabilities. Security teams are advised to prioritize remediation and monitor for signs of exploitation related to CVE-2025-33073.
Jun 29, 2026
CISA has confirmed that ransomware groups are actively exploiting a high-severity privilege escalation vulnerability in the Linux kernel, tracked as CVE-2024-1086. This use-after-free flaw, present in the netfilter: nf_tables component and introduced in 2014, was patched in January 2024 but remains a significant risk for unpatched systems. Successful exploitation allows attackers with local access to escalate privileges to root, enabling full system takeover, disabling of security defenses, installation of malware, and lateral movement within networks. The vulnerability affects a wide range of major Linux distributions, including Debian, Ubuntu, Fedora, and Red Hat, across kernel versions from 3.15 to 6.8-rc1. In March 2024, a security researcher published a detailed proof-of-concept exploit, further increasing the risk of widespread exploitation. CISA added CVE-2024-1086 to its Known Exploited Vulnerabilities (KEV) catalog in May 2024 and mandated that federal agencies secure affected systems by June 20, 2024. Despite the availability of a patch, ransomware campaigns have begun leveraging this flaw, though CISA has not disclosed specific threat actor identities or detailed attack campaigns. Security experts recommend immediate patching, or if not possible, implementing mitigations such as blocklisting 'nf_tables', restricting user namespace access, or loading the Linux Kernel Runtime Guard (LKRG) module. The public availability of exploit code and the broad impact across Linux environments underscore the urgency for organizations to address this vulnerability to prevent ransomware-driven compromise and data theft.
Jun 29, 2026
CISA updated its Known Exploited Vulnerabilities catalog to mark **CVE-2026-45659** in **Microsoft SharePoint Server** as linked to **known ransomware campaign use**, escalating concern around a flaw already tracked as actively exploited. The vulnerability is a deserialization of untrusted data issue that can let an authorized or low-privileged attacker execute arbitrary code over the network on unpatched SharePoint servers, and CISA continues to direct organizations to apply Microsoft mitigations under **BOD 26-04**. The agency had previously added the bug to the KEV catalog and required Federal Civilian Executive Branch agencies to remediate it within three days, while also urging defenders to verify patch deployment, monitor SharePoint servers for signs of exploitation, shorten patching cycles, and enable **AMSI** integration and **Microsoft Defender Antivirus** detections. Reporting cited internet scans showing more than **8,500** exposed SharePoint servers, including more than **200** still unpatched against **CVE-2026-45659**, underscoring the ongoing exposure as ransomware operators adopt the exploit.
Aug 15, 2026